DPDPA Rules 2023

Definition

The term DPDPA Rules 2023 commonly refers to the implementation framework of the Digital Personal Data Protection Act, 2023. While the Act was enacted in 2023, the operational Rules were issued later.

“DPDPA Rules 2023” is a common but incorrect label. The Digital Personal Data Protection Act was passed in 2023, but the Rules that put it into practice, the DPDP Rules, 2025, were notified on 13 November 2025.

People search for “DPDPA Rules 2023” because the Act carries that year. The two documents do different jobs. The Act sets out what organisations must do. The Rules set out how, with the procedures, timelines, and operational detail. You need both to build a compliance programme.

DPDP Act vs DPDP Rules

The Act (2023) is the law Parliament passed. It received Presidential assent on 11 August 2023 and sets out duties, rights, the Board, and penalties. For example, it requires reasonable security safeguards and breach intimation.

The Rules (2025) are made by the Central Government under Section 40 of the Act. They were notified on 13 November 2025 and set out procedures, timelines, and forms. For example, Rule 6 lists the minimum security safeguards, and Rule 7 requires the Board to be informed without delay, followed by a detailed report within 72 hours.

What the Act introduced

The Act created the core roles and concepts: Data Fiduciaries, who decide why and how personal data is processed; Data Processors, who process it on their behalf; Data Principal rights, such as access, correction, erasure, and grievance redressal; Consent Managers; legitimate uses of data without consent; Significant Data Fiduciaries with extra duties; and the Data Protection Board of India to enforce the law. Penalties go up to ₹250 crore.

Where the Rules fill in the details

Rule 3: notice to Data Principals
Rule 4: registration and duties of Consent Managers
Rule 7: personal data breach intimation
Rule 8: retention and erasure, including log retention
Rule 10: verifiable parental consent for children
Rule 13: extra duties for Significant Data Fiduciaries, including a DPIA and audits
Rule 14: how Data Principals exercise their rights
Rule 15: transfer outside India
Rules 17 to 21: the Data Protection Board

Key dates

11 August 2023: the DPDP Act receives Presidential assent.
January 2025: draft Rules released for public consultation.
13 November 2025: the final Rules are notified, and the Board-related rules take effect. Read them in the MeitY Gazette.
13 November 2026: Consent Manager registration (Rule 4) takes effect.
13 May 2027: most operational obligations take effect, including notice, security safeguards, breach intimation and children’s data.

How Privy helps

Privy turns the Act and Rules into day-to-day controls: automated data discovery to build a data inventory, consent lifecycle management, data mapping, Data Principal request management, breach workflows, and audit-ready reporting. Start with the DPDP Readiness Assessment to see where your gaps are.

Here’s everything you need to know about this term and how it fits into your compliance program.

Still have a question?

Strictly speaking, there were no DPDPA Rules in 2023. The Digital Personal Data Protection Act was enacted in 2023, while the operational Rules were issued later.

The DPDP Act establishes the legal framework for protecting digital personal data, while the DPDP Rules provide operational guidance on implementing many of the Act's provisions.

The Act introduces concepts such as Data Fiduciaries, Data Processors, Data Principals, Consent Managers, notice requirements, lawful processing, Data Principal rights, personal data breach obligations, Significant Data Fiduciaries, and the Data Protection Board of India.

Many users use the phrase because the Act was passed in 2023. However, the detailed implementation Rules were notified later.

Privy helps organizations operationalize DPDP compliance through automated data discovery, consent lifecycle management, data mapping, governance workflows, breach management, and audit-ready reporting.

Still have a question?